wiki error

[Tom Scavo]

Btw, David, I think you should take this issue to the users list. It
sounds like a bug or (as you say) something that needs to be better
documented.

Tom

On Thu, Jul 4, 2013 at 1:15 AM, David Champion <dgc at uchicago.edu> wrote:
>
> ... what was changed:
> * updated the "issuer" text in the <ul> under External Auth Handler > Technical Specs > Input Format and Processing Model. It was a little vague.
> * added the ISO time link for "AuthnInstant" bullet, and added ISO8601 example. This just seemed useful to have for an implementor.
> * added the following paragraph:
>
> Attributes placed into the ExternalAuth POST will be subjected to attribute policy as defined in the attribute-policy.xml file. This could be particularly significant if you define an attribute whose policy enforcement rests upon metadata properties. For example, any scoped attribute (such as eppn or affiliation) may incorporate the ScopingRules rule, which is predicated on a metadata definition of scope, referenced by the issuer's entityID. In this case you may need to adjust policy to accomodate arbitrary scope on these attributes.
>
> This paragraph is to address a problem I encountered.  I spent the
> better part of an hour working out why the SP was giving this message
> with no explanation:
>
> 2013-07-02 14:05:17 WARN Shibboleth.AttributeFilter [1]: removed value at position (0) of attribute (eppn) from (unknown source)
>
> It's because under the default eppn attribute policy, you need an
> expected scope, and you can only have that by having metadata for your
> issuer's entityID, which presumably the backdoor approach doesn't
> typically involve.  (I certainly don't know what metadata for a fake
> issuer would look like....)  I don't think my new paragraph is very
> clear (because I'm making this up as I go based on ill-understood
> observations), but it at least points in a useful direction.
>
> Probably it would be useful to have this in a table of common errors.
> I don't know whether it would be preferable to create a new one for
> NativeSPBackDoor, or to cite it in the general SP errors triage page.
>
> --
>        David Champion • dgc at uchicago.edu • University of Chicago
> Enrico Fermi Institute • Computation Institute • USATLAS Midwest Tier 2
> --
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net